Weekly Threat & Vulnerabilities Report

Command Injection

CISA-KEV

OSS

Zero Day

Critical

Affected Product

Zyxel NAS326 firmware

Exploited-in-Wild

False

CVSS Score

9.8

EPSS Score

0.93664

CVE-2024-5806

Improper Authentication

CISA-KEV

OSS

Zero Day

Critical

Affected Product

MOVEit Transfer

Exploited-in-Wild

MOVEit Transfer

CVSS Score

9.1

EPSS Score

0.00043

CVE-2024-28995

Path Traversal

CISA-KEV

OSS

Zero Day

High

Affected Product

SolarWinds Serv-U

Exploited-in-Wild

SolarWinds Serv-U

CVSS Score

7.5

EPSS Score

0.34343

CVE-2022-2586

Use-After-Free

CISA-KEV

OSS

Zero Day

High

Affected Product

Linux Kernel

Exploited-in-Wild

CISA Adds three known Exploited Vulberabilities to Catalog

CVSS Score

7.8

EPSS Score

0.01048

CVE-2022-24816

Remote Code Execution

CISA-KEV

OSS

Zero Day

Critical

Affected Product

GeoSolutionsGroup JAI-EXT

Exploited-in-Wild

CISA Adds Three Known Exploited Vulnerabilities to Catalog

CVSS Score

9.8

EPSS Score

0.96777

CVE-2020-13965

Stored Cross Site Scripting

CISA-KEV

OSS

Zero Day

Medium

Affected Product

Roundcube Webmail

Exploited-in-Wild

CISA Adds Three Known Exploited Vulnerabilities Catalog

CVSS Score

6.1

EPSS Score

0.00483

Exploit Activity and Mass Scanning Observed on Cytellite Sensors

Telemetry collected from Loginsoft sensors were analyzed and processed to derive insights on what is actively being exploited and actively being scanned. As source of truth, source IPv4 addresses & payloads can be provided on need-to-know basis.

CVE-2024-23692

CISA-KEV

Critical

Template Injection vulnerability in Rejetto HTTP File Server 2.3m

Affected Products

Rejetto HTTP File Server

Exploited-in-Wild

False

CVE-2023-4415

CISA-KEV

High

Improper Authentication vulnerability in Ruijie RG-EW1200G 07161417 r483

Affected Products

Ruijie RG-EW1200G 07161417 r483

Exploited-in-Wild

False

CVE-2023-38646

CISA-KEV

Critical

Remote code execution vulnerability in Metabase open source before 0.46.6.1 and Metabase Enterprise before 1.46.6.1.

Affected Products

Metabase open source/Enterprise

Exploited-in-Wild

Metabase open source/Enterprise

CVE-2023-33010

CISA-KEV

Critical

Buffer overflow vulnerability in the ID processing function in Zyxel ATP series firmware versions leads to denial of service or remote code execution on affected device

Affected Products

Zyxel ATP series firmware

Exploited-in-Wild

CISA Adds Two Known Exploited Vulnerabilities to Catalog

CVE-2023-20198

CISA-KEV

Critical

Privilege escalation vulnerability in web UI feature of Cisco IOS XE Software

Affected Products

Cisco IOS XE Web UI

Exploited-in-Wild

Cisco IOS XE Web UI

CVE-2023-26801

CISA-KEV

Critical

Command injection vulnerability in LB-LINK devices.

Affected Products

LB-LINK

Exploited-in-Wild

LB-LINK

CVE-2023-20073

CISA-KEV

Critical

Arbitrary File Upload Vulnerability in Cisco RV340, RV340W, RV345, and RV345P Dual WAN Gigabit VPN Routers

Affected Products

Cisco RV340, RV340W, RV345, and RV345P Dual WAN Gigabit VPN Routers

Exploited-in-Wild

False

CVE-2023-1389

CISA-KEV

High

Command Injection Vulnerability in TP-Link Archer AX-21.

Affected Products

TP-Link Archer AX-21

Exploited-in-Wild

TP-Link Archer AX-21

CVE-2022-30023

CISA-KEV

High

Command injection vulnerability via the Ping function in Tenda Products.

Affected Products

Tenda Devices

Exploited-in-Wild

Tenda Devices

CVE-2022-41040

CISA-KEV

High

Server-Side Request Forgery (SSRF) vulnerability in Microsoft Exchange Server

Affected Products

Microsoft Exchange Server

Exploited-in-Wild

Microsoft Exchange Server

Vulnerabilities abused by Botnet

Identified vulnerabilities exploited by Botnets, including recent CVEs logged in Malware Information Sharing Platform (MISP). Presenting the top 5 CVEs with payloads suggestive of Botnet activities, like utilizing wget with IP addresses.

CVE-2023-1389

An unauthenticated command injection vulnerability found in the TP-Link Archer AX21 WiFi router.

Affected Product

TP-Link Archer AX21

Exploit

An unauthenticated command injection vulnerability found in the TP-Link Archer AX21 WiFi router.

Abused by Botnet

CVE-2023-26801

Command injection vulnerability in LB-LINK BL-AC1900_2.0 1.0.1, BL-WR9000 2.4.9, BL-X26 1.2.5 and BL-LTE300 1.0.8

Affected Product

LB-LINK BL Devices

Exploit

LB-LINK BL Devices

Abused by Botnet

CVE-2017-17215

Remote code execution vulnerability in Huawei HG532 router

Affected Product

Huawei HG532

Exploit

Huawei HG532

Abused by Botnet

HinataBot
‍Zerobot
Mirai
Bashlite
Gitpaste
Beastmode
Enemybot
PerlBot
QakBot
Ircbot

CVE-2016-10372

Improper protocol access control vulnerability in Eir D1000 modem.

Affected Product

Eir D1000 modem

Exploit

Eir D1000 modem

Abused by Botnet

CVE-2015-2051

Arbitrary command execution vulnerability in D-Link DIR-645 Wired/Wireless Router

Affected Product

D-Link DIR-645 Wired/Wireless Router

Exploit

D-Link DIR-645 Wired/Wireless Router

Abused by Botnet

Vulnerabilities Abused by Malware

We proactively monitor the vulnerabilities which are targeted by adversaries. Each vulnerability is humanly studied and mapped with Mitre ATT&CK tactics and techniques. Source of information is derived from our vulnerability intelligence platform collected and curated information from various sources such as Twitter, Telegram, OSINT groups, Blogs, Data leak sites and more.

CVE-2024-29973

Critical

Command Injection vulnerability in “setCookie” parameter in Zyxel NAS326 and NAS542 devices

Patch

Command Injection vulnerability in “setCookie” parameter in Zyxel NAS326 and NAS542 devices

Targeted by Malware

Mirai

CVE-2022-35733

Critical

Missing Authentication for Critical Function vulnerability in UNIMO Technology digital video recorders and UDR-JA1016 firmware

Patch

Missing Authentication for Critical Function vulnerability in UNIMO Technology digital video recorders and UDR-JA1016 firmware

Targeted by Malware

zergeca

CVE-2022-2586

High

Use-After-Free vulnerability in Linux Kernel nft_object leads to privilege escalation

Patch

Use-After-Free vulnerability in Linux Kernel nft_object leads to privilege escalation

Targeted by Malware

PRE-NVD observed for this week

It refers to vulnerabilities discovered and potentially exploited before their official inclusion in the National Vulnerability Database. The LOVI Platform aggregates and distributes data from open sources and social media, currently tracking over 100 security alerts and planning to expand.

CVE-2024-1867

Local Privilege Escalation

Affected Product

G DATA Total Security

Reference

G DATA Total Security

CVE-2024-33605

Path Traversal

Affected Product

Sharp and Toshiba Tec multi-function printers

Reference

Sharp and Toshiba Tec multi-function printers